Skip to content

Universal Cross-app Attacks: Exploiting and Securing OAuth 2.0 in Integration Platforms#

USENIX Security '25 (34th USENIX Security Symposium) digest Program Core pick 13–15 August 2025

Recording

Kaixuan Luo et al., The Chinese University of Hong Kong; Samsung Research America — Core

Play the recording: Universal Cross-app Attacks: Exploiting and Securing OAuth 2.0 in Integration Platforms

  • Why: A platform-wide OAuth account-linking design flaw affecting Microsoft, Google, and Amazon integration platforms — a concrete, high-severity (CVSS 9.6) example of exactly the kind of OAuth/identity-integration failure that matters at the architecture level, not the implementation level.
  • What: Two new attacks — Cross-app OAuth Account Takeover (COAT) and Request Forgery (CORF) — exploiting the lack of app differentiation in multi-app OAuth account-linking on integration platforms (Workflow Automation, Virtual Assistants, Smart Homes). 11 of 18 tested platforms were vulnerable to COAT and 5 to CORF. (from abstract only)
  • How: Built COVScan, a semi-automated black-box tool that profiles OAuth designs across platforms to find cross-app vulnerabilities; a victim risks account takeover simply by linking any single malicious app, or even clicking a crafted link. (from abstract only)
  • Where applicable: General for any platform supporting third-party app marketplaces with OAuth-based account linking; the architectural lesson (differentiate apps, not just users, in the OAuth trust model) generalizes beyond the specific platforms tested.